RE: [Declude.JunkMail] Minimum weight of a filter
No -- that determines a weight at which filter processing will stop. But it sounds like you want the filter to only return a weight if multiple lines match. Great idea! In my opinion it should return only a non-zero result if a certain NUMBER of lines match. (not a certain weight is reached) This would allow us for example to set up a great AVFILTER file: avfilter.txt === BODY 0 contains virus BODY 0 contains infected BODY 0 contains detected BODY 0 contains contains BODY 0 contains attachment BODY 0 contains removed BODY 0 contains netsky RETURNONLYIF 3 === Global.cfg AVFILTER filter c:\imail\declude\avfilter.txt 15 0 If the above filter file would return a weight only if at least 3 entries matches then the 15 points should be added to the weighting system but wouldn't return any wheight only because one or two of this keywords are part of a message. The same tecnique could be used for several other filter files. For example microsoft, adobe, software, cheap, or also for combinations of negative keywords. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Minimum weight of a filter
I use Matt's modified copy of Kami's Nigerian Scam list as a test. I then use a combo test with Nigerian Scam and Sniffer-Scams (return code 53) or Nigerian-Scam Sniffer-Experimental (return code 62) to assign an additional punishment of 10 points. Matt's Nigeria-scam list can be found at: http://www.mail-archive.com/[EMAIL PROTECTED]/msg15578.html Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/22/04 10:45PM Scott, I working on trapping more Nigerian Scams. What would you do in a filter? Search the body for phrases that are found in these types of e-mails? Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Minimum weight of a filter - Nigerian Scams
It sounds like a feature request! The only way I though I can get around my original problem, was possibly this: Run my Nigerian-scams filter first. Add a Weight1, weight2, and Weight 3. test Run a tests filter, If weight 1, drop one point. If weight 2 drop 2 points. If weight 3 drop 3 points. Do normal tests. Sounds like more hassle than it would be worth. Scott Fisher Director of IT Farm Progress Companies [EMAIL PROTECTED] 04/23/04 03:21AM No -- that determines a weight at which filter processing will stop. But it sounds like you want the filter to only return a weight if multiple lines match. Great idea! In my opinion it should return only a non-zero result if a certain NUMBER of lines match. (not a certain weight is reached) This would allow us for example to set up a great AVFILTER file: avfilter.txt === BODY 0 contains virus BODY 0 contains infected BODY 0 contains detected BODY 0 contains contains BODY 0 contains attachment BODY 0 contains removed BODY 0 contains netsky RETURNONLYIF 3 === Global.cfg AVFILTER filter c:\imail\declude\avfilter.txt 15 0 If the above filter file would return a weight only if at least 3 entries matches then the 15 points should be added to the weighting system but wouldn't return any wheight only because one or two of this keywords are part of a message. The same tecnique could be used for several other filter files. For example microsoft, adobe, software, cheap, or also for combinations of negative keywords. Markus --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Minimum weight of a filter
Is there any way to limit a filter a minimum weight. If the Nigerian filter gets tripped for at least 3 points, I would like for it to be implemented. If it is less than 3 points, I'd like to ignore the filter. Declude JunkMail doesn't have an option to do that. However, someone here might be able to figure out a creative way to do this. Can I do this with minweight No -- that determines a weight at which filter processing will stop. But it sounds like you want the filter to only return a weight if multiple lines match. -Scott --- Declude JunkMail: The advanced anti-spam solution for IMail mailservers since 2000. Declude Virus: Ultra reliable virus detection and the leader in mailserver vulnerability detection. Find out what you've been missing: Ask for a free 30-day evaluation. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Minimum weight of a filter
No -- that determines a weight at which filter processing will stop. But it sounds like you want the filter to only return a weight if multiple lines match. That would be great. When can we expect it??? :') --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
RE: [Declude.JunkMail] Minimum weight of a filter
Scott, I working on trapping more Nigerian Scams. What would you do in a filter? Search the body for phrases that are found in these types of e-mails? Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
Re: [Declude.JunkMail] Minimum weight of a filter
Nigeria filtering Have a look at the spam assassin files. They have a very good Nigerian spam filter so you should be able to find the search strings in there. Search for Nigerian and you will find it in these files: 20_head_tests.cf 20_meta_tests.cf 20_phrases.cf 50_scores.cf Good Luck Cheers Adrian - - Original Message - From: Goran Jovanovic [EMAIL PROTECTED] To: [EMAIL PROTECTED] Sent: Friday, April 23, 2004 1:45 PM Subject: RE: [Declude.JunkMail] Minimum weight of a filter Scott, I working on trapping more Nigerian Scams. What would you do in a filter? Search the body for phrases that are found in these types of e-mails? Goran --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com. --- [This E-mail was scanned for viruses by Declude Virus (http://www.declude.com)] --- This E-mail came from the Declude.JunkMail mailing list. To unsubscribe, just send an E-mail to [EMAIL PROTECTED], and type unsubscribe Declude.JunkMail. The archives can be found at http://www.mail-archive.com.
